An issue exists in Mattermost Server prior to 5.13.0. Incoming webhook creation is not properly restricted.
mattermost mattermost server